Qubic validators halted the network on Sunday, October 18, 2026, after an attacker drained 1,404 user wallets of about 2.94 trillion QU. The tokens were worth roughly $1.3 million at the time. The project traced the theft to weak randomness in how certain wallets created their seeds, not to a flaw in the blockchain itself.
Qubic is a layer-1 (L1) blockchain that processes transactions without fees. QU is its native token, and exchanges list it under the ticker QUBIC. In an official update on X posted at 12:29 UTC on October 18, the project said the attacker emptied the wallets between 23:42 UTC on October 17 and 01:26 UTC on October 18, a window of 104 minutes.
Note: As of publication, Qubic’s official X post does not list any specific wallet addresses, transaction hashes, or explorer links to independently verify the drain details or the reported fund immobilization.
How Weak Seeds Exposed 1,404 Wallets
A seed is the secret string from which a wallet’s private keys are derived. Anyone who holds the seed controls the funds in that wallet. A safe seed must come from a source that cannot be predicted. If the generator produces too little randomness, an attacker can rebuild possible seeds and check which ones unlock funded wallets.
Qubic said seeds created with insufficient randomness let the attacker take control of the affected wallets. The project listed three exposed environments:
- Any browser on an iPhone or iPad before October 18, 2026
- Safari on a Mac before October 18, 2026
- The Qubic iOS app before July 2025
Qubic said the flaw sat in seed generation and did not affect the core Qubic protocol.
Computors Freeze 87.1% of Stolen Funds
Qubic does not use miners or standard validators. Its network relies on Computors, a fixed group of operators who process transactions and vote on network decisions as a quorum. Qubic measures network progress in “ticks,” a unit similar to a block number on other chains.
The Computors stopped the chain at tick 85,371,949, which halted all transaction processing. According to Qubic, 87.1% of the drained QU never left the network and stays immobilized on-chain. The other 12.9% went to MEXC, a centralized crypto exchange, whose team froze the receiving account within about an hour.
MEXC also suspended QUBIC deposits and withdrawals, saying the Qubic project team had requested the pause. Bitget suspended QUBIC deposits and withdrawals on October 18 and cited wallet maintenance. Neither exchange has given a date to resume services.
Wallet Version 4.26.4 Patches the Flaw
Qubic released wallet version 4.26.4, which replaces the old seed method with cryptographically secure randomness. The update protects only seeds created after the fix. Wallets made with the old method in the listed environments stay exposed, so users who created seeds there need a new seed generated with the patched version.
The fix follows a familiar pattern. JavaScript’s built-in Math.random() function does not provide cryptographically secure numbers, and developer documentation warns against using it for security work.
Recovery Now Rests With the Computor Quorum
Qubic said the Computor quorum will decide on recovery or restitution under network rules. The project plans to publish a full technical report once it finalizes a plan. Qubic has not said when the network will restart.
The team also warned users about recovery scams. Qubic said it will never message users first, ask for a seed, or charge a fee for recovery.
The incident adds to a run of seed generation failures in 2026. In July and August, a firmware flaw in Coldcard hardware wallets led to more than $100 million in stolen Bitcoin, also from predictable seeds. Qubic has drawn attention before, including its 2025 campaign to gain majority hashrate on Monero.
The halt kept most of the stolen QU from leaving the network. It also showed that a small group of Computors can stop the chain and decide what happens to frozen user funds. How the quorum handles restitution, and how fast the network restarts, will shape confidence in Qubic’s governance.
Also Read: Cysic Bridge Hack: Attacker Mints 10M CYS, Moves $727K to Ethereum
